Information Security Officer (CGRC)

ppCybersecurity is essential to keeping our global offshore operations safe and reliable. As Information Security Officer (CGRC), you set the governance and risk foundation that protects our IT, OT, and information assets. /p h3Your role in the story /h3 pAs Information Security Officer (CGRC), you lead cybersecurity governance across IT and OT at Heerema. You define policies and standards, drive risk assessments, and ensure compliance with regulations such as ISO, NIS2, and GDPR, working closely with IT, OT, and the business to embed security controls into daily operations and projects. /p h3What you will be working on /h3 ul liDefining and maintaining the cybersecurity governance framework, including top‑level security directives, policies, and supporting standards /li liEstablishing clear CGRC roles and responsibilities (RACI) across IT, OT, and the business /li liPlanning, executing and maintaining cybersecurity risk assessments, including project and third‑party risk /li liMapping security requirements to external frameworks and regulations (e.g. ISO/IEC 27001/2, NIST CSF/800‑53, IEC 62443, GDPR, NIS2, IMO) /li liCoordinating internal and external audits and managing audit findings and remediation /li liDefining CGRC KPIs, maturity metrics, dashboards, and management reporting /li liDeveloping and delivering role‑based cybersecurity awareness and training /li liMaintaining cybersecurity incident response governance, post‑incident reviews, and regulatory reporting in collaboration with relevant teams /li liBuilding strong partnerships across IT, OT, Legal, Compliance, Quality, HR, and external stakeholders /li /ul h3Key ingredients for success /h3 ul liHBO or WO degree; relevant certifications such as CISSP, CISM, ISO 27001 Lead Implementer/Auditor, or IEC 62443 are preferred /li li5+ years of experience in information security, risk, or compliance roles with demonstrable GRC leadership across IT and/or OT /li liHands‑on experience with security frameworks (ISO/IEC 27001/2, NIST CSF/800‑53), privacy (GDPR), EU directives (e.g. NIS2), and IMO cybersecurity requirements /li liStrong understanding of risk methodologies, control testing, audit practices, and evidence management /li liAbility to structure policies and standards and operate governance processes across complex organizations /li liStrong communication skills, able to translate between technical and non‑technical audiences in English and Dutch /li liComfortable working across IT, OT, and operational environments, balancing regulatory obligations with business realities /li /ul h3Benefits /h3 ul liStrong compensation benefits, including an annual bonus plan tied to company performance /li liBonus basis = your annual gross salary + 13th month + 8% holiday allowance /li liFuture‑proof pension: gross scheme covering base + 13th month + holiday allowance, with no mandatory contribution up to €72,488.52 /li li30 days off to recharge, with the option to buy 10 extra days /li liFree access to an in‑house gym, including fitness classes /li liActivities to connect with colleagues (e.g. Friday‑afternoon get‑together) /li liA modern and easily accessible office in Leiden /li /ul /p #J-18808-Ljbffr